Fake Software Installers Disable Windows Update and Weaken Microsoft Defender
- ID
- 20809
- Status
- summarized
- Published
- 03 Sep 2026, 12:41 AM
- Fetched
- 03 Sep 2026, 2:39 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/fake-software-installers-disable.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 4.5
- Created
- 03 Sep 2026, 2:39 AM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
An active malware campaign uses high-fidelity clone websites (.com.cn / .hl.cn domains) impersonating vendors like Microsoft Edge, Calibre, draw.io, Kaspersky, and Baidu Pan to serve malicious installers that disable Windows Update and weaken Microsoft Defender. Microsoft attributes the activity with moderate confidence to the Chinese threat cluster Silver Fox, which has previously distributed Gh0st RAT and ValleyRAT. The downloaded ZIP payloads are generated server-side per request with changing hashes, and persistence is achieved via scheduled tasks or the trusted msiexec.exe service.
Why it matters
If your team or users in Malaysia/SEA download common tools (Calibre, draw.io, Edge, Kaspersky) from search results, verify the exact domain — the spoofed sites listed (e.g., calibre-ebook[.]com[.]cn, cn-drawio[.]com[.]cn) are near-perfect clones with a prominent download button. Because the payload hash changes per download, static AV signatures won't reliably catch it, so blocklisted domains and download-source policy matter more than endpoint scanning alone.
Discussion angle
Discuss whether your org's software-download policy (allowlist of vendor domains, internal package mirrors) would actually stop a user from hitting one of these clone sites, given that the lookalike domains are the main attack vector.